monocul.us/de4dot-cex
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add 1.0.7.0 sig

Browse Source
This commit is contained in:
de4dot 2013-11-17 02:04:11 +01:00
parent a6eee49ff0
commit aa01d4eebb
4 changed files with 14 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
de4dot.code/deobfuscators/ILProtector/Deobfuscator.cs
View File

@ -118,11 +118,16 @@ namespace de4dot.code.deobfuscators.ILProtector {
else if (dynamicMethodsRestorer != null) {
Logger.v("Runtime file versions:");
Logger.Instance.Indent();
bool emailMe = false;
foreach (var info in mainType.RuntimeFileInfos) {
var version = info.GetVersion();
emailMe |= version == null && System.IO.File.Exists(info.PathName);
emailMe |= version != null && version == new Version(1, 0, 7, 0);
Logger.v("Version: {0} ({1})", version == null ? "UNKNOWN" : version.ToString(), info.PathName);
}
Logger.Instance.DeIndent();
if (emailMe)
Logger.n("**** Email me this program! de4dot@gmail.com");
dynamicMethodsRestorer.Decrypt();
RemoveObfuscatorJunk(dynamicMethodsRestorer);

8
de4dot.code/deobfuscators/ILProtector/DynamicMethodsDecrypter.cs
View File

@ -159,13 +159,13 @@ namespace de4dot.code.deobfuscators.ILProtector {
public abstract byte[] Decrypt(int methodId, uint rid);
}
// 1.0.7.1 - 1.0.8.0
class DecrypterV1_0_7_1 : DecrypterBase {
// 1.0.7.0 - 1.0.8.0
class DecrypterV1_0_7_0 : DecrypterBase {
DecryptMethod decryptMethod;
unsafe delegate bool DecryptMethod(int appDomainId, int asmHashCode, int methodId, out byte* pMethodCode, out int methodSize);
public DecrypterV1_0_7_1(DynamicMethodsDecrypter dmd, FieldDef delegateField)
public DecrypterV1_0_7_0(DynamicMethodsDecrypter dmd, FieldDef delegateField)
: base(dmd) {
IntPtr addr = GetDelegateAddress(delegateField);
decryptMethod = (DecryptMethod)Marshal.GetDelegateForFunctionPointer(addr, typeof(DecryptMethod));
@ -348,7 +348,7 @@ namespace de4dot.code.deobfuscators.ILProtector {
if (delegateField == null)
return null;
return new DecrypterV1_0_7_1(this, delegateField);
return new DecrypterV1_0_7_0(this, delegateField);
}
IDecrypter CreateDecrypterV2_0_0_0() {

2
de4dot.code/deobfuscators/ILProtector/RuntimeFileInfo.cs
View File

@ -45,6 +45,7 @@ namespace de4dot.code.deobfuscators.ILProtector {
}
static readonly VersionInfo[] versionInfo32 = new VersionInfo[] {
new VersionInfo(new Version(1, 0, 7, 0), new byte[] { 0x94, 0x79, 0x6E, 0xC1, 0x1F, 0x6D, 0xE9, 0xE3, 0x2F, 0x5E, 0xA3, 0x57, 0x71, 0x02, 0x22, 0x6A }),
new VersionInfo(new Version(1, 0, 7, 1), new byte[] { 0x8D, 0xCE, 0xAB, 0x0C, 0xA6, 0xA9, 0x4A, 0xA2, 0xCE, 0x43, 0xDE, 0x38, 0xEA, 0xDE, 0x0D, 0x3A }),
new VersionInfo(new Version(1, 0, 8, 0), new byte[] { 0x44, 0x09, 0x33, 0xCE, 0x90, 0x43, 0xF9, 0xC2, 0x2F, 0x11, 0x40, 0x1D, 0x18, 0xDA, 0x63, 0x3B }),
new VersionInfo(new Version(2, 0, 0, 0), new byte[] { 0xFD, 0x1D, 0x2B, 0x73, 0x2F, 0xD8, 0x27, 0x5F, 0xA3, 0x83, 0x76, 0x36, 0x29, 0x8E, 0x51, 0xA9 }),
@ -65,6 +66,7 @@ namespace de4dot.code.deobfuscators.ILProtector {
};
static readonly VersionInfo[] versionInfo64 = new VersionInfo[] {
// No sig for 1.0.7.0 x64 since I don't have it yet.
new VersionInfo(new Version(1, 0, 7, 1), new byte[] { 0x68, 0x4C, 0xC0, 0xC2, 0x55, 0x75, 0x72, 0x09, 0x12, 0x10, 0xA4, 0xF3, 0xFE, 0x95, 0x4D, 0x7A }),
new VersionInfo(new Version(1, 0, 8, 0), new byte[] { 0x99, 0xAF, 0x3D, 0x39, 0x16, 0xC2, 0xD6, 0x10, 0x6E, 0x09, 0x64, 0xDE, 0xA4, 0xB3, 0x30, 0xE5 }),
new VersionInfo(new Version(2, 0, 0, 0), new byte[] { 0x02, 0x90, 0xDA, 0xBD, 0x37, 0xEE, 0x20, 0x86, 0xA7, 0x30, 0x31, 0x6D, 0x92, 0xEF, 0xB3, 0x01 }),

6
de4dot.code/deobfuscators/ILProtector/StaticMethodsDecrypter.cs
View File

@ -146,13 +146,13 @@ namespace de4dot.code.deobfuscators.ILProtector {
}
}
// 1.0.6 - 1.0.7.0
// 1.0.6.x
class DecrypterV106 : DecrypterBase {
byte[] decryptionKey6;
byte[] decryptionKey7;
DecrypterV106(byte[] key0, byte[] key6, byte[] key7, int startOffset) {
this.ilpVersion = "1.0.6 - 1.0.7.0";
this.ilpVersion = "1.0.6.x";
this.startOffset = startOffset;
this.decryptionKey = key0;
this.decryptionKey6 = key6;
@ -178,7 +178,7 @@ namespace de4dot.code.deobfuscators.ILProtector {
var key0 = DeobUtils.Sha1Sum(sha1Data); // 1.0.6.0
var key6 = GetKey(reader, key0, keyXorOffs6); // 1.0.6.6
var key7 = GetKey(reader, key0, keyXorOffs7); // 1.0.6.7 - 1.0.7.0
var key7 = GetKey(reader, key0, keyXorOffs7); // 1.0.6.7
return new DecrypterV106(key0, key6, key7, encryptedOffs);
}
catch (IOException) {